Protection Against Timing-based Security Attacks on Re-order Buffers

ABSTRACT

Methods, systems, and apparatuses related to re-order buffers and for protection from timing-based security attacks are described. A processor may have functional units configured to execute instructions out of order, a re-order buffer configured to buffer the execution results of instructions for output in order, and a controller configured to randomize data timing in the re-order buffer. For example, the controller can make random adjustments to the capacity of the re-order buffer in buffering and/or sorting execution results and thus randomize data timing in the re-order buffer.

RELATED APPLICATIONS

The present application is a continuation application of U.S. patentapplication Ser. No. 16/210,609 filed Dec. 5, 2018, the entiredisclosures of which application are hereby incorporated herein byreference.

TECHNICAL FIELD

At least some embodiments disclosed herein relate generally to computerarchitecture and more specifically, but not limited to, techniques toprotect against security attacks on re-order buffers.

BACKGROUND

Instructions are typically programmed to be executed sequentially. Aprogram order of instructions is the order in which the instructions areprogrammed for execution in a processor.

It is possible to execute some instructions according to an alternativeorder and obtain the same result(s) as executing the instructionsaccording to the program order.

Out-of-order execution have been implemented in some processors toimprove the utilization of the processing power of the processors andincrease the overall speed of executing a program having a sequence ofinstructions.

For example, when the processor is about to process an instruction thatis configured to operate on an operand, the operand may be in theprocess of being loaded from a cache, or a main memory, or a storagedevice. However, the operand of the next instruction in the programorder may be ready for processing in the processor. Thus, the processormay execute the next instruction, instead of pausing the execution ofinstructions to wait for the operand that is being loaded from thecache, the main memory, or the storage device.

A “data order” of instructions is the order in which the data oroperands of the instructions become available in the processor forprocessing. The data order is typically different from the program orderin contemporary processor design. A processor can be configured toexecute instructions according to the data order of the instructions,instead of the program order of the instructions.

A re-order buffer can be used to temporally hold the execution resultsof instructions that are executed out of their program order. Forexample, the instructions can be executed in the data order of theinstructions. The results stored in the re-order buffer can be moved outof the re-order buffer in the program order of the respectiveinstructions, as if the results were generated by executing theinstructions according to the program order. For example, a sequence of3 instructions can be a first instruction to load an operand A into afirst register (e.g., “load A, r1”), a second instruction to loadanother operand B into a second register (e.g., “load B, r2”), and athird instruction to add a number to the second register (e.g., “add #1,r2”). It is possible to execute the second instruction (e.g., “load B,r2”) out of order before the execution of the first instruction (e.g.,“load A, r1”), execute the third instruction (e.g., “add #1, r2”), andthen execute the first instruction (e.g., “load A, r1”). Such analternative execution sequence can be desirable when the memory systemcan return the operand B before the operand A. For example, when thedata becomes ready in the order of B, #1, A, the instructions can beexecuted in the order of “load B, r2”, “add #1, r2”, and “load A, r1”,which is different from the program order of “load A, r1”, “load B, r2”,and “add #1, r2”.

Implementations of out-of-order execution may have securityvulnerability. Examples of such security vulnerabilities in computerprocessors include Meltdown and Spectre that were made public in 2018.For example, security vulnerabilities may allow data to be cached from aprivileged security boundary, resulting in a race condition that couldbe timed to leak privileged information. An example of data in aprivileged security boundary is data located in the operating systemkernel.

BRIEF DESCRIPTION OF THE DRAWINGS

The embodiments are illustrated by way of example and not limitation inthe figures of the accompanying drawings in which like referencesindicate similar elements.

FIG. 1 shows a buffer controller configured to protect againsttiming-based security attacks on a re-order buffer according to oneembodiment.

FIG. 2 shows an out-of-order execution controlled by a buffer capacitycontroller according to one embodiment.

FIG. 3 shows a method to protect against timing-based security attackson re-order buffers according to one embodiment.

FIG. 4 show a computing system in which the method of FIG. 3 can beimplemented.

DETAILED DESCRIPTION

The present disclosure includes techniques for protection againsttiming-based security attacks on re-order buffers.

A timing-based security attack relies upon a timing pattern of resultsin a re-order buffer. Such an attack can be prevented and/or madedifficult to implement by randomizing the timing pattern of results inre-order buffers.

For example, the timing pattern of results in a re-order buffer can bedependent on the operating capacity of the re-order buffer. Theactual/operating capacity of the re-order buffer usable to re-orderresults of instructions that are executed out of their program order canbe changed randomly from time to time such that the timing patternchanges from time to time. Such a capacity adjustment can be performedrandomly in time, or periodically, to introduce randomness in the timingof the results in the re-order buffer.

FIG. 1 shows a buffer controller (115) configured to protect againsttiming-based security attacks on a re-order buffer (113) according toone embodiment. For example, the buffer controller (115) can beimplemented in a processor of a computer system illustrated in FIG. 4.

In FIG. 1, the re-order buffer (113) is configured to receive results ofinstructions in an order in which instructions are executed. The resultsin the re-order buffer (113) can be moved out of the re-order buffer(113) for committing into a register file of a processor (e.g., 181 inFIG. 4), a cache memory of the processor, and/or a memory external tothe processor, based on a “graduation order.” The graduation order ofthe results in the re-order buffer (113) for instructions is the orderin which the results of the instructions are committed and theinstructions are retired for completion; and the graduation order(retirement order, or commitment order) is typically configured to beconsistent with the program order of the instructions. The executionresult of an instruction that is to be executed early in the programorder is to be graduate from the re-order buffer (113) early. A resultof an instruction can be moved out of the re-order buffer (113) forcommitting when the results of instructions programmed before theinstruction in the program order are ready to be moved out of there-order buffer (113) for committing. In some instances, someinstructions can be executed in parallel units, threads or pipelines;and the graduation order (retirement order, or commitment order) fromthe re-order buffer (113) preserves sequential consistency. In general,sequential consistency requires that the result of any execution is thesame as if the instructions were executed in a sequential orderspecified by its program. Commitment or committing to a register may bereferred to as writing to a register. So results may be committed to aregister by a processor configured to write the results to the register.

The capacity of the re-order buffer (113) determines the depth of asequence of instructions that can be executed out of order before aresult can graduate from the re-order buffer (113). A same set ofinstructions executed using re-order buffers (e.g., 113) of differentcapacities can have different timings of results buffering in there-order buffer (113). Thus, changing the capacity of the re-orderbuffer (113) can change the pattern of out of order of executions.Randomizing the change in the capacity of the re-order buffer (113) canintroduce randomness in data timing in the re-order buffer (113) andthus remove the predictability of timing in the re-order buffer (113)and defeat or prevent timing-based security attacks on the re-orderbuffer (113).

In some instances, the re-order buffer (113) has a predetermined fullcapacity. The buffer controller (115) identifies a usable capacity ofthe re-order buffer (113) for sorting the incoming results (111) thatare provided in the order of actual execution/completion ofinstructions. When the usable capacity identified by the buffercontroller (115) is reached, the out-of-order execution of instructionsbeyond the set of instructions for each the re-order buffer (113) canbuffer their results is prevented, until some of the results in there-order buffer graduate from the re-order buffer (113).

The usable capacity of the re-order buffer (113) can be a randomfraction of the predetermined full capacity of the re-order buffer(113). The randomness in usable capacity of the re-order buffer (113)can destroy or weaken the predictability of timing of the re-orderbuffer (113) and thus protect against timing-based security attack onthe re-order buffer (113).

In some instances, the re-order buffer (113) can have a dynamicallyallocated amount of capacity for sorting the results in execution order(111) into the results in graduation order (117). The buffer controller(115) controls the dynamic allocation of the capacity for the re-orderbuffer (113) (e.g., based on the output of a random number generator).

In some instances, multiple processing cores can have multiple re-orderbuffers (e.g., 113) respectively. A buffer controller (115) candynamically re-allocate a shared buffer capacity for the multiplere-order buffers (e.g., 113). For example, instead of evenly dividingthe shared buffer capacity among the multiple re-order buffers (e.g.,113), the buffer controller (115) can randomize the ratios of capacityallocations among the multiple re-order buffers (e.g., 113) to causerandomness in timing.

In some instances, the buffer controller (115) re-configures the usablecapacity of the re-order buffer (113) periodically at a regular,predetermined time interval. Alternatively, a usable capacity can beconfigured for the re-order buffer (113) for a random time period ofoperation; and after the random time period of operation, the usablecapacity of the re-order buffer (113) can be reconfigured for anotherrandom period of operations. Time periods of operation may be referredto as, e.g., a first period of time and a second period of timefollowing the first period of time. The randomness in the lengths ofperiods of operation at two or more constant usable capacities can alsoreduce or destroy the timing predictability in the re-order buffer(113).

FIG. 2 shows an out-of-order execution controlled by a buffer capacitycontroller (114) according to one embodiment. For example, the buffercontroller (115) of FIG. 1 can be implemented using the buffer capacitycontroller (114) of FIG. 2 with a random number generator (116) torandomize out-of-order execution of instructions. The random numbergenerator (116) can be configured to prevent an attacker from detectingthe sequence of outputs generated from the random number generator (116)and/or its algorithm for generating randomized outputs. For example,statistically random noises on computer buses can be used in the randomnumber generator (116) to prevent an attacker from accurately predictingthe outputs of the random number generator (116). Electrical noises ingeneral cannot be modeled accurately. Such stochastic processes are, intheory, completely unpredictable; and the theory's assertions ofunpredictability are subject to experimental tests. In general, anytechniques for securing a random number generator (116) against attackscan be used. Thus, the present disclosure is not limited to any specificimplementations of random number generators.

In FIG. 2, instructions (101) fetched according to the program order ofthe instructions are buffered in the instruction buffer (103). Theinstructions (101) can be fetched from a cache memory of a processor,from a memory of a computer system, and/or a storage device of thecomputer system (e.g., as illustrated in FIG. 6).

The instructions in the instruction buffer (103) can be executed infunctional units (109) of the processor when the data/operands (107) ofthe instructions are available to the functional units.

In general, some of the data operands (107) of the instructions may beloaded from a cache memory of the processor, from the memory of thecomputer system, and/or from the storage device of the computer system(e.g., illustrated in FIG. 6). Other data operands (107) of theinstructions can be the results of the executions of other instructions.Such results may be available in registers/register files of theprocessor and/or in the re-order buffer (113).

Loading certain data items (e.g., from a cache memory, a main memory, ora storage device) can take a time period that is longer than theprocessing of one or more data-ready instructions. The data/operands(107) of data-ready instructions can be used by the functional units(109) in a short time period. Thus, such data-ready instructions (105)in the instruction buffer (103) can be issued to functional units (109)for execution according to a data order that is different from theprogram order.

The functional units (109) generates results (111) in an order ofexecution/completion of instructions; and the results (111) aretemporally stored in the re-order buffer (113) for their graduation. Aresult of each respective instruction can graduate/retire/be committedfrom the re-order buffer (113) when the results of instructions beforethe respective instruction are in the re-order buffer (113) and readyfor graduation, or have already graduated from the re-order buffer(113).

Results (117) in the graduation order, which is consistent with theprogram order of their instructions (101), can be moved out of there-order buffer (113) for committing into registers (register files, acache, a main memory, and/or a storage device) (119).

When the capacity of the re-order buffer (113) is fixed, the timing ofthe results (111) in the re-order buffer (113) for a given set ofinstructions may be predicted, determined, and/or exploited by asecurity attack to gain unauthorized knowledge about the execution ofinstructions and/or their data.

To destroy, reduce, or weaken the predictability of the timing of theresults (111) entering the re-order buffer (113) and/or the results(117) leaving the re-order buffer (113), the buffer capacity controller(114) can inject randomness in the timing by randomizing the usablecapacity of the re-order buffer (113) in sorting the results (111/117).

For example, the buffer capacity controller (114) can include, or becoupled to, a random number generator (116). The output of the randomnumber generator (116) can be used in the buffer capacity controller(114) to determine a limit of usable portion of the re-order buffer(113) in sorting the results (111/117).

For example, when a result set graduates from the re-order buffer (113),the buffer capacity controller (114) can determine an adjustment to theusable portion of the re-order buffer (113) in sorting the results(111/117). The adjustment can be made via adding dummy results into there-order buffer (113), or removing dummy results that have beenpreviously added to the re-order buffer (113). The dummy results addedinto the front or the back of the queue (or another location) in there-order buffer (113) effectively reduces the usable portion of there-order buffer (113) for sorting the results (111/117).

For example, the output of the random number generator (116) can beconverted to a count of dummy results to be kept in the re-order buffer(113) for a next time period of operations of the re-order buffer. Thecount of dummy results corresponds to a fraction of the full capacity ofthe re-order buffer (113). If the current count of dummy results in there-order buffer (113) is larger than the desired count converted fromthe output of the random number generator (116), the buffer capacitycontroller (114) removes one or more dummy results from the re-orderbuffer (113), as if the dummy results were to graduate from the re-orderbuffer (113). If the current count of dummy results in the re-orderbuffer (113) is smaller than the desired count converted from the outputof the random number generator (116), the buffer capacity controller(114) adds one or more dummy results to the re-order buffer (113) (e.g.,in the slots vacated by the results (117) that recently graduate fromthe re-order buffer (113)), as if the dummy results were generated bythe functional units (109) as a result of executing dummy instructions.

Alternatively, the buffer capacity controller (114) can be configured toadjust, according to the random number generator (116), one or moreboundaries of the re-order buffer (113) that define the capacity of thebuffer capacity controller (114).

In some instances, the output of the random number generator (116)controls when the buffer capacity controller (114) adjusts the usablecapacity of the re-order buffer (113).

For example, the output of the random number generator (116) can be usedto set a threshold count of cycles of operations of the re-order bufferbetween two successive adjustments. After the threshold count of cyclesof operations following a prior adjustment, the buffer capacitycontroller (114) can adjust again the capacity of the re-order buffer(113).

Cycles of operations of the re-order buffer can be counted based on apredetermined number of instruction cycles (or clock cycles) of theprocessor in one embodiment.

Alternatively, a cycle of operations can be counted as being between twosuccessive graduations of result sets (117) from the re-order buffer(113). In such a situation, the length of the cycle may not be aconstant relative to a clock cycle and/or an instruction cycle.

FIG. 3 shows a method to protect against timing-based security attackson re-order buffers according to one embodiment. For example, the methodof FIG. 3 can be implemented using the buffer controller (115) of FIG. 1or the buffer capacity controller (114) of FIG. 2.

At block 131, a processor (e.g., 181 in FIG. 4) executes instructions inan order that is different from a program order in which theinstructions are programmed.

For example, the processor can execute the instructions according to adata order in which the data/operands of the instructions are ready inthe processor for processing.

At block 133, the processor buffers execution results (111) of theinstructions in a re-order buffer (113).

For example, the execution results (111) of instructions can enter there-order buffer (113) in an order that is different from the programorder of the instructions. For example, first instructions can beprogrammed to be processed earlier than second instructions; due toout-of-order execution, execution results of the second instructions canarrive in the re-order buffer (113) earlier than the results of firstinstructions; and in such a situation, the execution results of thesecond instructions can wait in the re-order buffer (113) until theresults of first instructions arrive in the re-order buffer (113), suchthat the results of the first and second instructions can be providedfrom the re-order buffer (113) according to the program order of theinstructions.

At block 135, the re-order buffer (113) outputs the results of theinstructions in accordance with the order in which the instructions areprogrammed.

At block 137, a controller (e.g., 115 or 114) determines whether toadjust the capacity of the re-order buffer (113).

For example, the controller (e.g., 115 or 114) can determine at aregular time interval whether to adjust the capacity of the re-orderbuffer (113).

For example, the controller (e.g., 115 or 114) can determine whether toadjust the capacity of the re-order buffer (113) when some results canbe moved out of the re-order buffer (113) for graduation according tothe program order.

For example, the controller (e.g., 115 or 114) can determine whether toadjust the capacity of the re-order buffer (113) when more than athreshold number of results can be moved out of the re-order buffer(113) for graduation according to the program order.

For example, the controller (e.g., 115 or 114) can determine whether toadjust the capacity of the re-order buffer (113) when more than athreshold number of batches of results have been moved out of there-order buffer (113) for graduation according to the program order.

At block 139, if the controller (e.g., 115 or 114) decides to adjust thecapacity of the re-order buffer (113), the controller (e.g., 115 or 114)determines an adjustment to the capacity of the re-order buffer (113)according to an output from a random number generator (116).

For example, the controller (e.g., 115 or 114) can decide to increase ordecrease the capacity of the re-order buffer (113) by a random amountcalculated based on the output of the random number generator (116).

In some instances, the controller (e.g., 115 or 114) can decide toincrease or decrease the capacity of the re-order buffer (113) (e.g., bya predetermined amount) at a randomized time instance controlled by therandom number generator (116).

Optionally, the controller (e.g., 115 or 114) can decide to increase ordecrease the capacity of the re-order buffer (113) at a random timecontrolled by a random amount.

At block 141, the controller (e.g., 115 or 114) implements therandomized adjustment to the capacity of the re-order buffer (113).

For example, the controller (e.g., 115 or 114) can adjust the number ofdummy results inserted in the re-order buffer (113) to control theuseful capacity of the re-order buffer (113) in sorting results.

For example, the controller (e.g., 115 or 114) can adjust the boundariesof the re-order buffer (113) to control the useful capacity of there-order buffer (113) in sorting results.

For example, the controller (e.g., 115 or 114) can re-partition a set ofmemory cells configured for multiple re-order buffers (e.g., 113) toadjust their capacities, including the capacity of the re-order buffer(113).

FIG. 4 show a computing system in which the method of FIG. 3 can beimplemented.

The computing system of FIG. 4 can include a processor (181) having aninternal cache (191), a memory device (187), an external cache (193),and a storage device (189) that is connected to the processor (181)and/or the memory (187) via an interconnect (185).

For example, the processor (181) can have functional units (109) toexecute instructions. The processor (181) can further include registers(153) to contain memory addresses, data/operands of instructions to beexecuted in the functional units (109), and/or execution results of theinstructions.

For example, the registers (153) can include a program counter forloading instructions for execution, and a memory address register. Whenan instruction is being executed in the processor (181), the memoryaddress stored in the memory address register can be used to load anoperand of the instruction, and/or store a computing result generatedfrom executing the instruction.

The processor (181) can execute instructions out of their program orderand make the results of instructions available in the program orderusing the re-order buffer (113).

The processor (181) has a controller (151) that is configured to causerandomness in timing of results entering and/or leaving the re-orderbuffer (113). For example, the randomness can be implemented viarandomized adjustments to the useful capacity of the re-order buffer(113), using any of the techniques discussed above in connection withFIGS. 1-3. For example, the controller (151) can be configured as thebuffer controller (115) of FIG. 1, or the buffer capacity controller(114) of FIG. 2, to randomize data timing in the re-order buffer (113)using a method of FIG. 3.

The randomizing techniques discussed above can cause the usages of there-order buffer (113) to be different for each execution of a sameprogram. One of the consequences of the use of the techniques is thatfor multiple executions of the same program with the same data set underexactly the same computation conditions (same number of users, sameamount of physical memory, etc.) the execution time of the program canbe different. In many cases, this arrangement by itself can be highlysecure against timing attacks.

For example, one of the more publicize security attacks was to determinea cryptographical key, based on timing. When the timing is just one ortwo cycles different for execution instances, a large body of suchattacks can be rendered useless on computer systems having reorderbuffers configured in ways discussed in the present disclosure.

For example, the processor (181) can issue instructions to thefunctional units (109) from the internal cache (191) (e.g., aninstruction buffer (103)) when the data/operands of the instruction areavailable in the internal cache (191), the registers (153), and/or there-order buffer (113). The processor (181) buffers the execution resultsof the instructions generated by the functional units (109) forgraduation in accordance with the program order of the instructions. Theprocessor (181) can move the results from the re-order buffer (113) inthe program order to registers (153), the internal cache (191), theexternal cache (193), the memory device (187), and/or the storage device(189) with a controller (195).

In some instances, the addresses used the registers of the processor(181) are virtual memory addresses; and a memory management unit (MMU)(183) can convert the virtual memory addresses to physical memoryaddresses to access the external cache (193), the memory device (187),and/or the storage device (189).

For example, the data in the memory device (187) can be cached in theexternal cache (193) of the processor (181) and/or the internal cache(191) of the processor (181).

For example, the data in the external cache (193) can be cached in theinternal cache (191).

For example, the data in the storage device (189) can be cached in thememory device (187), in the external cache (193), and/or in the internalcache (191).

In some instances, the memory management unit (MMU) (183) controls thedata movement among the internal cache (191), the external cache (193),and the memory device (187).

The techniques disclosed herein can be applied to at least to computersystems where processors are separated from memory and processorscommunicate with memory and storage devices via communication busesand/or computer networks. Further, the techniques disclosed herein canbe applied to computer systems in which processing capabilities areintegrated within memory/storage. For example, the processing circuits,including executing units and/or registers of a typical processor, canbe implemented within the integrated circuits and/or the integratedcircuit packages of memory media to perform processing within a memorydevice. Thus, a processor (e.g., 181) as discussed above and illustratedin the drawings is not necessarily a central processing unit in the vonNeumann architecture. The processor can be a unit integrated withinmemory to overcome the von Neumann bottleneck that limits computingperformance as a result of a limit in throughput caused by latency indata moves between a central processing unit and memory configuredseparately according to the von Neumann architecture.

The description and drawings of the present disclosure are illustrativeand are not to be construed as limiting. Numerous specific details aredescribed to provide a thorough understanding. However, in certaininstances, well known or conventional details are not described in orderto avoid obscuring the description. References to one or an embodimentin the present disclosure are not necessarily references to the sameembodiment; and, such references mean at least one.

In the foregoing specification, the disclosure has been described withreference to specific exemplary embodiments thereof. It will be evidentthat various modifications can be made thereto without departing fromthe broader spirit and scope as set forth in the following claims. Thespecification and drawings are, accordingly, to be regarded in anillustrative sense rather than a restrictive sense.

What is claimed is:
 1. A device, comprising: a buffer having a fullcapacity; a random number generator; and a controller configured toadjust a currently usable capacity of the buffer as a random fraction ofthe full capacity based on an output of the random number generator. 2.The device of claim 1, wherein the device includes a processor havingthe buffer, the controller, and one or more functional units.
 3. Thedevice of claim 2, wherein the buffer is configured to store results ofinstructions executed in the one or more functional units out of orderrelative to a programmed order of the instructions.
 4. The device ofclaim 3, wherein the processor further includes registers; and theprocessor is further configured to write the results from the buffer tothe registers according to the programmed order of the instructions. 5.The device of claim 4, wherein the controller is configured to adjustthe currently usable capacity periodically.
 6. The device of claim 4,wherein the controller is configured to update the random fractionperiodically according to an output of the random number generator. 7.The device of claim 4, wherein the controller is configured to updatethe random fraction after a random time period.
 8. The device of claim4, wherein the controller is configured to change a timing pattern inresults, generated by the instructions and stored in the buffer, byadjusting the random fraction.
 9. The device of claim 8, furthercomprising: an instruction buffer, wherein the processor is configuredto fetch the instructions into the instruction buffer in accordance theprogrammed order of the instructions and issue instructions from theinstruction buffer to the one or more functional units out of orderrelative to the programmed order of the instructions.
 10. A processor,comprising: a first buffer having a full capacity; a random numbergenerator; and a controller configured to adjust a currently usablecapacity of the first buffer as a random fraction of the full capacitybased on an output of the random number generator.
 11. The processor ofclaim 10, further comprising: one or more functional units; and a secondbuffer; wherein the processor is configured to fetch instructions intothe second buffer in a first order, and issue the instructions from thesecond buffer to the one or more functional units in a second orderdifferent from the first order; and wherein the first buffer isconfigured to store results of execution of the instructions by the oneor more functional units as issued from the second buffer.
 12. Theprocessor of claim 11, further comprising: registers, wherein theprocessor is further configured to write the results from the firstbuffer to the registers according to the first order.
 13. The processorof claim 12, wherein the controller is configured to adjust thecurrently usable capacity periodically.
 14. The processor of claim 12,wherein the controller is configured to update the random fractionperiodically according to an output of the random number generator. 15.The processor of claim 12, wherein the controller is configured toupdate the random fraction after a random time period.
 16. The processorof claim 12, wherein the controller is configured to change a timingpattern in results, generated by execution of the instructions andstored in the first buffer, by adjusting the random fraction.
 17. Amethod, comprising: generating, using a random number generator of adevice, an output; and adjusting, by a controller of the device having afirst buffer and based on the output of the random number generator, acurrently usable capacity of the first buffer as a random fraction of afull capacity of the first buffer.
 18. The method of claim 17, furthercomprising: fetching instructions into a second buffer in a first order;issuing the instructions from the second buffer to one or morefunctional units of the device in a second order different from thefirst order; and storing, into the first buffer, results of execution ofthe instructions by the one or more functional units as issued from thesecond buffer.
 19. The method of claim 18, further comprising: writingthe results from the first buffer to registers of the device accordingto the first order.
 20. The method of claim 19, further comprising:updating the random fraction periodically using the random numbergenerator.